CVE-2026-27002
📋 TL;DR
OpenClaw's Docker sandbox configuration injection vulnerability allows attackers to escape container isolation and access the host system. This affects OpenClaw personal AI assistant deployments using Docker sandboxing prior to version 2026.2.15. Attackers could potentially access host data or execute code on the underlying host.
💻 Affected Systems
- OpenClaw
📦 What is this software?
Openclaw by Openclaw
⚠️ Risk & Real-World Impact
Worst Case
Full container escape leading to host system compromise, data exfiltration, and lateral movement within the environment.
Likely Case
Unauthorized access to host files and directories, potential privilege escalation, and data leakage.
If Mitigated
Limited to container-level access with no host system impact when proper sandbox restrictions are enforced.
🎯 Exploit Status
Requires ability to modify OpenClaw sandbox configuration settings. No public exploit code has been released.
🛠️ Fix & Mitigation
✅ Official Fix
Patch Version: 2026.2.15
Vendor Advisory: https://github.com/openclaw/openclaw/security/advisories/GHSA-w235-x559-36mg
Restart Required: Yes
Instructions:
1. Update OpenClaw to version 2026.2.15 or later. 2. Restart OpenClaw services. 3. Verify configuration schema validation is enabled.
🔧 Temporary Workarounds
Secure Docker Sandbox Configuration
linuxManually restrict dangerous Docker options in OpenClaw configuration
# Edit OpenClaw configuration to ensure:
# agents.*.sandbox.docker.binds does NOT mount system directories or Docker socket
# agents.*.sandbox.docker.network = 'none' or 'bridge'
# Do not use 'unconfined' for seccomp or AppArmor profiles
🧯 If You Can't Patch
- Review and audit all OpenClaw sandbox configurations for dangerous Docker options
- Implement network segmentation to isolate OpenClaw containers from sensitive systems
🔍 How to Verify
Check if Vulnerable:
Check OpenClaw version and review configuration for dangerous Docker sandbox settings like network=host, unconfined profiles, or system directory bind mounts.Check Version:
openclaw --versionVerify Fix Applied:
Verify OpenClaw version is 2026.2.15 or later and test that dangerous Docker options are rejected by configuration validation.📡 Detection & Monitoring
Log Indicators:
- Docker container creation with host networking
- Attempts to mount system directories or Docker socket
- Use of unconfined security profiles
Network Indicators:
- Containers attempting to access host network services
SIEM Query:
docker.event=create AND (docker.network=host OR docker.security_profile=unconfined)